CVE-2026-89651

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ceph: bound MDSCapAuth path and fs_name decode in handle_session()

handle_session() decodes the MDSCapAuth records carried by a

CEPH_SESSION_OPEN message (msg_version >= 6). For each record the

match.path and match.fs_name byte strings are read by first decoding a

32-bit length and then copying that many bytes with the bare

ceph_decode_copy(). Unlike the surrounding fields, which all use the

_safe decode variants, these two copies are not preceded by a

ceph_decode_need() bounds check, and the enclosing MDSCapAuth and

MDSCapMatch struct_len fields are skipped rather than enforced as an

upper bound. A length larger than the bytes remaining in the message

front makes ceph_decode_copy() read past the end of the front buffer.

The message front is a dedicated allocation (ceph_msg_new2() ->

kvmalloc), so the over-read runs off that object. A malicious or

compromised MDS can trigger this with the first post-connect message

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References